The present invention is related to the field of malware detection in computer systems.
Malicious software of “malware” includes so-called Advanced Persistent Threats (APTs) characterized by persistent, background execution with a purpose of stealing sensitive information and/or obtaining unauthorized access to computing resources. Detecting APTs and taking remediation actions has typically been difficult. Traditional anti-malware products, including anti-virus applications, depend on file signatures for detection of malware. Signatures of the executable files of known malware are stored in a database, and detection products scan a target system for files having matching signatures. Such detection techniques can be thwarted by creating variants that have the same or similar functionality but different signatures, a technique which is used to some degree by fraudsters. These detection techniques can also be thwarted by malware that actively seeks to avoid detection by disabling anti-virus software, embedding itself into an operating system kernel, and other methods.
There is a movement in computing toward virtual machine based computing platforms which employ emulated or “virtual” computers (machines) executing on a physical computer. Virtual machines are susceptible of infection with malware in the same manner as physical machines, and traditional anti-malware techniques have the same limitations arising from reliance on file signatures.